27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a

Sharing

Copy URL Twitter E-mail

General

Target
27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a
Size 4.0MB
Sample260729-gv2ctsysgw
SHA256 27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a
MD5 d9c7cfc2e2f0dfa1fd02058d50be3810
SHA1 489a6371497a5e531f15df592f2038f452a3b83f
SHA512 62e8215690d933ed4aa07d3293921629c43e9c5a48cdf6df78e5340a5e205980895f94d27c6013843323bf43a9d345a0ee6b58f242a4d712ec506a9d0c828ddd
SSDEEP 49152:+GtlqMoVwASOTZIU6i6uF1H/6M9PJuDF2A0inQ2xRRFs6OQxlHJTKw8PwkwmInEX:Ue+/9P4BRFGTeL9RIi1/e2E
TLSH
T1CF16AE56B7A400E8D4B6C17CC6A74627DBB2B85913B0EBDB06A4C6761F13BE1263F704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a

File Explorer

27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a

.dll 4.0MB

27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a

IMPHASH 58043537a1ba2a4d7371d2c4fd7b38ca
SHA256 27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a
MD5 d9c7cfc2e2f0dfa1fd02058d50be3810
SHA1 489a6371497a5e531f15df592f2038f452a3b83f
SHA512 62e8215690d933ed4aa07d3293921629c43e9c5a48cdf6df78e5340a5e205980895f94d27c6013843323bf43a9d345a0ee6b58f242a4d712ec506a9d0c828ddd
SSDEEP 49152:+GtlqMoVwASOTZIU6i6uF1H/6M9PJuDF2A0inQ2xRRFs6OQxlHJTKw8PwkwmInEX:Ue+/9P4BRFGTeL9RIi1/e2E
TLSH
T1CF16AE56B7A400E8D4B6C17CC6A74627DBB2B85913B0EBDB06A4C6761F13BE1263F704
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2743700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\work\zb_toolsv2\WhdsFileDistribution\x64\Release\baseDownloadSdk.pdb

wldap32

ord143 ord217 ord46 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord211 ord301

ws2_32

recv getsockname getpeername connect bind accept ntohs socket htons WSAGetLastError closesocket WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSACleanup WSAStartup setsockopt WSASetLastError __WSAFDIsSet select htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname WSAIoctl

crypt32

CertCloseStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore

rpcrt4

UuidCreate

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW PathRemoveBackslashW PathRemoveFileSpecW PathRemoveExtensionW PathFileExistsW PathAddBackslashW

shell32

SHGetSpecialFolderPathW

iphlpapi

if_nametoindex

kernel32

LoadLibraryExW InterlockedFlushSList RtlUnwindEx GetSystemInfo OpenEventA CreateEventA OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent ExitThread FreeLibraryAndExitThread GetFileInformationByHandle GetConsoleOutputCP SetFilePointerEx ExitProcess SetConsoleCtrlHandler FlsAlloc FlsGetValue FlsSetValue TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo LCMapStringEx FlsFree VirtualProtect GetDateFormatW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WriteConsoleA WriteFile GetDynamicTimeZoneInformation GetCurrentThreadId Sleep GetConsoleMode GetCurrentProcessId HeapFree DeviceIoControl InitializeCriticalSectionEx HeapSize GetLastError CreateFileA HeapReAlloc CloseHandle LoadLibraryW HeapAlloc DecodePointer GetProcAddress DeleteCriticalSection GetProcessHeap CreateDirectoryW GetModuleFileNameW GetTimeFormatW ReadFile CreateFileW GetFileAttributesW DeleteFileW MoveFileExW GetFileSizeEx UnmapViewOfFile CreateFileMappingW MapViewOfFile SetLastError FileTimeToSystemTime FileTimeToLocalFileTime WideCharToMultiByte LoadLibraryA FreeLibrary FindClose WaitForSingleObject GetTimeZoneInformation GetTickCount64 GetFileAttributesExW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime GetSystemTime MultiByteToWideChar FormatMessageW LocalFree FormatMessageA GetCurrentProcess GetLocalTime TryEnterCriticalSection FindFirstFileW EnterCriticalSection FindNextFileW WaitForMultipleObjects InitializeCriticalSectionAndSpinCount LeaveCriticalSection RtlUnwind SetEvent TerminateThread ResetEvent QueueUserAPC SleepEx GetDriveTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency RtlVirtualUnwind QueryPerformanceCounter GetTickCount GetFullPathNameW MoveFileExA WaitForSingleObjectEx CreateThread GetEnvironmentVariableA CompareFileTime GetFileType PeekNamedPipe VerSetConditionMask GetModuleHandleA VerifyVersionInfoW GetEnvironmentVariableW GetModuleHandleW SetConsoleMode ReadConsoleA ReadConsoleW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber SetFileTime SetFilePointer LCMapStringW CompareStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetCurrentDirectoryW SetStdHandle HeapQueryInformation SetEndOfFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetPrivateProfileStringW CreateEventW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW TryAcquireSRWLockExclusive GetExitCodeThread GetCPInfoExW InitOnceComplete InitOnceBeginInitialize RtlPcToFileHeader RaiseException EncodePointer

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW wsprintfA

comdlg32

GetFileTitleW

advapi32

CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ReadEventLogA CloseEventLog OpenEventLogA

bcrypt

BCryptGenRandom

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

998KB

Virtual Size

998KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

27929bcf33f19cf5400a19b152b96a2bb45bac156d301655a6069c02e4b7990a

wldap32

ws2_32

crypt32

rpcrt4

version

shlwapi

shell32

iphlpapi

kernel32

user32

comdlg32

advapi32

bcrypt

generic